Auditing data anomaly detection method and device, electronic equipment and storage medium

Abstract

The invention discloses an audit data anomaly detection method and device, electronic equipment and a storage medium, and belongs to the technical field of data processing. The method comprises the steps that auditing data are obtained, and the auditing data comprise at least one of user identity data, operation time, operation types, operation objects, operation results, IP addresses, operation behavior information, command line input data, network request information and system resource use data; a detection model is determined according to the audit data, the detection model is associated with the data type of abnormal behavior data in the audit data, and the detection model comprises at least one of the following items: a strategy configuration layer, a large model layer based on natural language processing and an Angle Transform model layer; and inputting the audit data into the detection model to obtain an anomaly detection result.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of communication, and particularly relates to an audit data anomaly detection method and device, electronic equipment and a storage medium. BACKGROUND

[0002] With the rapid development of big data and cloud computing technology, data middle platform has become the core hub of enterprise data processing and storage. The large-scale and complex data flow and operation it carries make it a high-risk target of network attacks, and various security threats such as data leakage, vulnerability exploitation and denial of service attacks occur frequently, which seriously threatens the security of enterprise data assets and business continuity.

[0003] At present, audit data monitoring and anomaly detection, as a key technology for data security protection, faces many challenges in practical application. Traditional anomaly detection techniques are mostly based on rule matching or simple machine learning methods, such as identifying known attack patterns through a pre-set rule library or constructing a detection model using a basic classification algorithm. However, due to factors such as data scale expansion, complex structure and dynamic evolution of attack methods, such methods are difficult to adapt to new attack scenarios.

[0004] Therefore, it is urgent to improve the accuracy of anomaly detection of audit data. SUMMARY

[0005] The purpose of the embodiments of the application is to provide an anomaly detection method and device for audit data, electronic equipment and a storage medium, which can improve the accuracy of anomaly detection of audit data.

[0006] In a first aspect, the embodiments of the application provide an anomaly detection method for audit data, which comprises:

[0007] Obtaining audit data, wherein the audit data comprises at least one of the following: user identity data, operation time, operation type, operation object, operation result, IP address, operation behavior information, command line input data, network request information and system resource usage data;

[0008] Determining a detection model according to the audit data, wherein the detection model is associated with the data type of abnormal behavior data in the audit data, and the detection model comprises at least one of the following: a policy configuration layer, a large model layer based on natural language processing and an Anomaly Transformer model layer;

[0009] Inputting the audit data into the detection model to obtain an anomaly detection result.

[0010] In a second aspect, the embodiments of the application provide an anomaly detection device for audit data, which comprises:

[0011] According to the anomaly detection result, a response measure is determined; the anomaly detection result includes an anomaly type and early warning information;

[0012] When the anomaly type is brute force cracking, the response measure includes blocking the corresponding IP address and limiting login of the brute force cracking corresponding IP address within a preset time period.

[0013] When the anomaly type is data leakage, the response measure includes suspending related data access permission, notifying a data administrator to check, and encrypting or isolating the related data.

[0014] When the anomaly type is SQL injection attack, the response measure includes blocking the corresponding user request, re-verifying the user identity data corresponding to the user request, and auditing the database operation.

[0015] When the anomaly type is denial of service attack, the response measure includes starting a flow limiting strategy, limiting or banning the attack source IP, and adjusting the system resource allocation strategy.

[0016] In a third aspect, an electronic device is provided, which includes a processor and a memory, the memory stores programs or instructions executable on the processor, and the programs or instructions are executed by the processor to implement the steps of the method according to the first aspect.

[0017] In a fourth aspect, a readable storage medium is provided, which stores programs or instructions, and the programs or instructions are executed by a processor to implement the steps of the method according to the first aspect.

[0018] In a fifth aspect, a chip is provided, which includes a processor and a communication interface, the communication interface is coupled to the processor, the processor is configured to run programs or instructions to implement the method according to the first aspect.

[0019] In a sixth aspect, a computer program product is provided, which is stored in a storage medium, and the program product is executed by at least one processor to implement the method according to the first aspect.

[0020] In the embodiments of the present application, by acquiring audit data, the audit data includes at least one of the following: user identity data, operation time, operation type, operation object, operation result, IP address, operation behavior information, command line input data, network request information and system resource usage data; determine the detection model according to the audit data, the detection model is associated with the data type of the abnormal behavior data in the audit data, and the detection model includes at least one of the following: policy configuration layer, large model layer based on natural language processing and Anomaly Transformer model layer; the rule-based detection mechanism can immediately identify security threats that conform to known patterns, providing timely warnings for security teams; the semantic understanding ability of the natural language processing large model enables the system to adapt to new attack methods without frequent updates to the rule library; the time series analysis capability of Anomaly Transformer enables the system to detect anomalies in data streams in real time and respond to potential threats in a timely manner; input the audit data into the detection model, which can detect the audit data through at least one of the policy configuration layer, the large model layer based on natural language processing and the Anomaly Transformer model layer, identify behaviors or events that do not conform to normal patterns, and obtain abnormal detection results, which can improve the accuracy of abnormal detection of audit data and support more effective security decisions. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 is a flowchart of an audit data anomaly detection method provided by an embodiment of the present application;

[0022] Figure 2 is a flowchart of another audit data anomaly detection method provided by an embodiment of the present application;

[0023] Figure 3 is a structural diagram of a detection model provided by an embodiment of the present application;

[0024] Figure 4 is a structural diagram of an audit data anomaly detection device provided by an embodiment of the present application;

[0025] Figure 5 is a hardware structural diagram of an electronic device of an embodiment of the present application. DETAILED DESCRIPTION

[0026] The technical solutions of the embodiments of the present application will be described in detail below with reference to the drawings of the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all embodiments. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art are within the scope of the present application.

[0027] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally a class and do not limit the number of objects, for example, the first object can be one or more. In addition, "and / or" in the specification and claims indicates at least one of the connected objects, and the character " / ", generally indicates that the objects before and after are in a "or" relationship.

[0028] To solve the problems of the related art, the embodiments of the present application provide an audit data anomaly detection method and device, which can improve the accuracy of audit data anomaly detection.

[0029] The audit data anomaly detection method provided by the embodiments of the present application will be described in detail below in combination with the drawings, specific embodiments and application scenarios.

[0030] Figure 1 A flowchart of the audit data anomaly detection method provided by the embodiments of the present application.

[0031] As Figure 1 shown, the audit data anomaly detection method can include steps 110-130, and the method is applied to an audit data anomaly detection device, as shown below:

[0032] Step 110, obtaining audit data, the audit data including at least one of the following: user identity data, operation time, operation type, operation object, operation result, IP address, operation behavior information, command line input data, network request information and system resource usage data;

[0033] Audit data: refers to various operation records and event logs generated by a system or application during operation. These data contain user behavior, system state and operation result information, and are the basic data source for security monitoring and anomaly detection.

[0034] Collect security-related operation records from multiple data sources to build a comprehensive security monitoring data set. By integrating different types of audit data, user behavior and system state can be analyzed from multiple dimensions, improving the accuracy of anomaly detection.

[0035] Step 120, determining a detection model according to the audit data, the detection model being associated with a data type of abnormal behavior data in the audit data, the detection model including at least one of the following: a policy configuration layer, a large model layer based on natural language processing, and an Anomaly Transformer model layer.

[0036] Policy configuration layer: A rule-based detection mechanism that filters and analyzes audit data based on pre-set security rules and conditions. These rules are typically developed by security experts based on known attack patterns and security policies, allowing for quick identification of abnormal behavior that matches specific characteristics.

[0037] Large model layer based on natural language processing: Utilizes large language models' semantic understanding capabilities to perform in-depth analysis on unstructured audit data. These models can capture implicit semantics and contextual information in text, identifying potential malicious intent.

[0038] Anomaly Transformer model layer: A Transformer architecture-based anomaly detection model that captures long-range dependencies in time-series data through self-attention mechanisms, making it particularly suitable for handling complex patterned audit data streams. It learns the characteristic distribution of normal behavior and identifies abnormal events that deviate from these patterns.

[0039] Based on the type and characteristics of the audit data, the most suitable detection model or combination of models is selected. This layered design allows the system to employ the most effective detection methods for different types of abnormal behavior:

[0040] The policy configuration layer is suitable for quickly identifying attacks with known patterns; the large model layer based on natural language processing excels at analyzing potential threats in textual content; and the Anomaly Transformer model layer focuses on discovering abnormal patterns in time-series data.

[0041] Step 130, input the audit data into the detection model to obtain anomaly detection results.

[0042] Apply the collected audit data to the selected detection model, and through the calculation and analysis of the model, identify behaviors or events that do not conform to normal patterns. The anomaly detection results output by the model can be a binary judgment or a risk score, providing decision-making basis for security response.

[0043] As shown in Figure 2 In one possible embodiment, step 130 can include the following steps:

[0044] Step 210, in the case where the detection model includes a policy configuration layer, detect the audit data through pre-set detection rules and output the first anomaly detection result;

[0045] Step 220, in the case where the detection model includes a large model layer, use natural language processing techniques to analyze the context of the text information in the audit data and output the second anomaly detection result;

[0046] Step 230: Feature extraction on time series data in audit data based on self-attention mechanism, output third anomaly detection result.

[0047] Pre-set detection rules: Conditions set by security experts based on known attack patterns and security policies. These rules define the characteristic patterns of specific behaviors or events, and when audit data matches these patterns, it is judged as abnormal.

[0048] Time series data: A series of data points arranged in chronological order. In security audits, time series data can include user login times, system operation frequencies, network traffic, and other data that changes over time, used to analyze behavior patterns and trends.

[0049] Step 210: Filter and match audit data based on pre-set rules. The policy configuration layer usually contains two types of rules: whitelist rules: define allowed normal behavior patterns; blacklist rules: define known malicious behavior patterns;

[0050] When audit data matches blacklist rules or violates whitelist rules, the system marks it as abnormal. The advantage of this method is fast and high certainty, but the disadvantage is that it can only detect attacks of known patterns.

[0051] Step 220: Analyze text information in audit data using natural language processing technology. The large model layer usually contains the following processing procedures:

[0052] Clean and standardize text data, convert text to vector representation, analyze the context relationship of text through attention mechanism, understand the semantics and potential intent of text, judge whether the text contains malicious content based on trained model. For example, the large model can analyze whether the SQL query statement contains injection attack features, or whether the command line input attempts to perform privilege escalation operations.

[0053] Step 230: Analyze time series part of audit data, main procedures include:

[0054] Convert raw audit data to time series format, extract statistical and timing features of time series, convert time series to vector representation that can be processed by model, capture long-distance dependence relationship in sequence through self-attention mechanism, identify abnormal points that deviate from normal patterns based on learned normal patterns. The core advantage of Anomaly Transformer is that it can automatically learn the timing patterns of data, without the need for manual definition of features, and has good ability to capture complex nonlinear patterns.

[0055] Through three different detection models, from rule matching, semantic understanding and time series analysis, the coverage and accuracy of the detection are improved. Each of the three models has its own advantages, the strategy configuration layer provides fast known threat detection, the large model layer handles complex text analysis, and the Anomaly Transformer handles time series anomalies. The combination of the three forms a complement, reducing the false negative rate and false positive rate. The large model layer and the Anomaly Transformer model layer have stronger adaptive ability, can identify new attacks and unknown threats, and reduce the dependence on frequent updates of the rule library. As shown in Figure 3 , the three models can be designed as real-time processing procedures to ensure that the system can respond to security events in a timely manner and reduce potential losses.

[0056] In one possible embodiment, step 210 can specifically include the following steps:

[0057] Set preset detection rules for different operation behavior indicators, including at least one of the following: login failure times threshold, data access permission rule, access frequency rule;

[0058] According to the audit data, the operation behavior indicators are counted, including at least one of the following: user login failure times, data access times, access time interval;

[0059] Detect the audit data corresponding to the operation behavior indicators through the preset detection rules, and output the first abnormality detection result, which includes the first abnormality type and the first warning information;

[0060] The first abnormality type includes at least one of the following: brute force attack, account anomaly, data leakage; the warning information includes at least one of the following: abnormality occurrence time, user identity data, IP address, operation object.

[0061] Operation behavior indicators: quantitative measures of user or system operation behavior, used to describe behavior patterns and characteristics. In security audits, these indicators can reflect whether user behavior conforms to normal patterns and are important basis for anomaly detection.

[0062] Preset detection rules: a set of conditions defined in advance based on security policies and known attack patterns, used to determine whether operation behavior is abnormal. These rules usually set thresholds or conditions, and when operation behavior indicators exceed thresholds or meet certain conditions, trigger abnormal alarms.

[0063] Login failure times threshold: the maximum number of login failures allowed within a certain time window. Frequent login failures exceeding this threshold may indicate a brute force attack or account anomaly.

[0064] Data access permission rules: the scope of access permissions for specific data resources by users or roles, including read, write, modify, etc. Data access that violates these rules may constitute a data leakage risk.

[0065] Access frequency rules: set the upper limit of access frequency of system resources by users or IP addresses. Abnormally high access frequency may indicate the activity of automated attack tools or malicious crawlers.

[0066] First anomaly detection result: the anomaly detection result generated by the policy configuration layer, including anomaly type and warning information, used to identify and describe potential security threats detected.

[0067] First anomaly type: the security threat category determined according to detection rules and abnormal behavior characteristics, such as brute force cracking, account anomaly, or data leakage, etc.

[0068] First warning information: notification content containing detailed information of abnormal events, used for security team to quickly locate and respond to security incidents, usually including time, user, IP, etc. Key information.

[0069] First, according to the security policy and known attack patterns, set detection rules for different operation behavior indicators. Rule setting usually considers the following factors: different business scenarios may have different security requirements, set reasonable threshold based on historical behavior patterns, update rules combined with the latest security threat intelligence, adjust rule sensitivity according to the severity of potential risks.

[0070] Then, extract and calculate key operation behavior indicators from audit data:

[0071] User login failure times: count the number of login failures of a specific user or IP within a time window;

[0072] Data access times: count the frequency of user access to sensitive data;

[0073] Access time interval: calculate the time interval between consecutive operations to identify abnormal operation rhythm;

[0074] These indicators usually need to be counted in a sliding time window to capture short-term abnormal behavior.

[0075] Then, compare the statistical operation behavior indicators with the preset detection rules to determine whether the indicator value exceeds the preset threshold, check whether the behavior sequence conforms to the known abnormal pattern, consider the combination conditions of multiple indicators to improve detection accuracy, and when an anomaly is detected, the system generates a first anomaly detection result containing anomaly type and warning information.

[0076] Finally, the abnormal type and warning information are generated, the abnormal type is automatically classified according to the triggered rule and abnormal behavior characteristics, for example: frequent login failure corresponds to brute force cracking, unauthorized data access corresponds to data leakage, and abnormal operation outside working hours corresponds to account anomaly. The warning information extracts key context information from the audit data to help the security team quickly understand the nature and impact of the abnormal event.

[0077] The rule-based detection mechanism can immediately identify security threats that conform to known patterns, providing timely warnings for the security team. By monitoring key operational behavior indicators, common security threats such as brute force cracking and data leakage can be effectively prevented.

[0078] Through statistical analysis of abnormal types and frequencies, enterprises can understand the main security threats they face and optimize security strategies and resource allocation. The rule detection of the policy configuration layer can be combined with AI-based detection methods such as the large model layer and the Anomaly Transformer layer to form a multi-level security protection system.

[0079] In one possible embodiment, step 220 can specifically include the following steps:

[0080] Extract the request body and command line fields in the audit data;

[0081] Perform pattern matching on the request body and command line fields to obtain attack patterns, the attack patterns including at least one of the following: SQL injection pattern, privilege abuse pattern, and vulnerability exploitation pattern;

[0082] Perform context analysis on the audit data to obtain text analysis results; the text analysis results including at least one of the following: user information, geographic location, and device information;

[0083] Output a second abnormality detection result according to the attack pattern and the text analysis result.

[0084] Request body: In network communication, the request body is a part of the data packet sent by the client to the server, usually containing detailed content of the request, such as form data, JSON data or file upload content. In security audit, the request body may contain sensitive information or malicious code.

[0085] Command line field: refers to the instructions or parameters input by the user in the system command line interface, such as SQL query statements, system commands or API call parameters. The command line field directly reflects the user's operation intention and is the key data for detecting malicious operations.

[0086] Pattern matching processing: A text analysis technique based on strings or regular expressions, used to identify whether a specific pattern is contained in the text. In security detection, pattern matching is used to detect whether the request body or command line field contains known attack patterns.

[0087] Attack pattern: A predefined pattern of malicious code or operation, used to identify a specific type of security attack. Common attack patterns include SQL injection, cross-site scripting (XSS), command injection, etc.

[0088] SQL injection pattern: An attack pattern in which a malicious user bypasses the application's security checks by constructing special SQL statements to directly manipulate the database. For example, entering 'OR'1' = '1' in the login form may cause unconditional passing of verification.

[0089] Privilege abuse pattern: A behavior pattern in which a user or process accesses system resources beyond its authorized scope, such as a normal user attempting to execute administrator commands or access restricted files.

[0090] Exploit pattern: An attack pattern that exploits known software vulnerabilities, usually containing specific exploit code or parameters. For example, a buffer overflow attack code targeting a specific version of software.

[0091] Text analysis result: Information obtained by analyzing the text content in the audit data, including user identity, device information, operating environment, and other contextual information, used to assist in determining the legality of the operation.

[0092] Second anomaly detection result: An anomaly detection result generated by the large model layer, based on attack pattern recognition and context analysis, used to identify and describe potential security threats detected.

[0093] Extract key text content from audit data, usually including:

[0094] The request body part in the HTTP request, the instructions entered by the user in the command line interface, the parameters of API calls, and the database query statements. These text contents directly reflect the user's operation intention and are the key data sources for detecting malicious operations.

[0095] Use predefined attack patterns to match and detect the extracted text content, extract features that may be related to attacks from the text, such as SQL keywords, command execution symbols, etc., and compare the extracted features with the known attack pattern library, calculate the similarity between the text and the attack pattern, and if it exceeds the threshold, it is determined as a potential attack. For example, when detecting the SQL injection pattern, the system will check whether the text contains keywords such as SELECT, UNION, DROP, and whether there are abnormal quotation marks or bracket combinations.

[0096] By analyzing the context information of the text, further understanding its true intention, specifically can combine the user's historical behavior patterns, judge whether the current operation is abnormal, analyze the environment of operation execution, such as time, place, device, etc., check the user's permission state, judge whether the operation is within its authorized range, analyze other events related to the current operation, and identify potential attack chains. For example, the same command may be normal when executed under an administrator account, but may be a misuse of privileges when executed under a normal user account.

[0097] Based on context analysis, the system extracts key text analysis results, including:

[0098] User information: such as username, role, permission level;

[0099] Geographical location: the physical location where the operation occurs;

[0100] Device information: the type of device used for the operation, IP address, etc.

[0101] Time information: the time point when the operation occurs, to determine whether it is within normal working hours;

[0102] These information are used to assist in determining the legality of the operation and improve the accuracy of anomaly detection.

[0103] Finally, the system combines attack pattern matching results and text analysis results to comprehensively determine whether there is an anomaly. If the text matches known attack patterns and context analysis shows anomalies, it is determined to be a high-risk anomaly. If only attack patterns are matched, but context analysis shows normal (such as test operations in development environment), it may be a false positive. If context analysis shows anomalies, but no known attack patterns are matched, it may be a new type of attack and needs further analysis. In this way, false positives can be effectively reduced, and more complex security threats can be identified.

[0104] Through pattern matching and context analysis, the system can understand the true intention of the text content in audit data, rather than just surface features. The semantic understanding-based analysis method can identify transformed or variant attack patterns and has certain detection ability for unknown threats. Context analysis considers the environment and user behavior patterns of the operation, which can effectively distinguish between normal operations and malicious operations, reducing false positives.

[0105] The text analysis results contain rich context information, helping security teams to better understand abnormal events, quickly respond and handle security threats. The semantic analysis of the large model layer can be combined with rule detection of the policy configuration layer and time series analysis of the AnomalyTransformer layer to form a multi-level security protection system.

[0106] In one possible embodiment, the Anomaly Transformer model includes a self-attention layer, an encoder, and a decoder. In step 230, the model can specifically include the following steps:

[0107] Extracting the time series data from the audit data, which includes at least one of the following: network traffic data, system resource usage data, timing information of operation behavior occurrence;

[0108] Through the self-attention layer, the dependency between time series data corresponding to different time steps is calculated based on the self-attention mechanism, and long-term dependency features are obtained;

[0109] The time series data and the long-term dependency features are encoded by the encoder to generate feature representations for each time step;

[0110] The feature representations for each time step are decoded by the decoder to obtain a predicted traffic behavior sequence;

[0111] Compare the predicted traffic behavior sequence with the actual traffic behavior sequence to obtain difference information;

[0112] Output the third anomaly detection result according to the difference information, and the anomaly behavior type in the third anomaly detection result includes at least one of the following: malicious program, host anomaly, remote command execution, denial of service attack.

[0113] Time series data: a sequence of observation data arranged in chronological order, used in security auditing to capture the changing patterns of system behavior over time. Abnormal fluctuations or pattern changes in time series data often indicate potential security threats.

[0114] Self-attention mechanism: the core component of the Transformer architecture, allowing the model to dynamically focus on the relevance between elements at different positions in the sequence when processing sequence data. By calculating attention weights, the model can capture long-distance dependencies without being limited by sequence length.

[0115] Long-term dependency features: long-distance association patterns between different time points in time series data identified by the self-attention mechanism. These features reflect the inherent laws of system behavior and are crucial for detecting abnormal behavior.

[0116] Encoder: part of the Transformer architecture, responsible for converting input sequences into high-level feature representations. In anomaly detection, the encoder learns the normal patterns and features of time series data.

[0117] Decoder: Another part of the Transformer architecture, responsible for reconstructing or predicting the output sequence from the feature representations generated by the encoder. In anomaly detection, the decoder predicts future system behavior based on learned normal patterns.

[0118] Predicted traffic behavior sequence: The model's prediction of future system behavior, such as network traffic or resource usage, based on historical data and learned normal patterns.

[0119] Actual traffic behavior sequence: The actual behavior data generated by the system, reflecting the true state.

[0120] Difference information: The deviation or inconsistency between the predicted sequence and the actual sequence, used to quantify the degree of anomaly. The larger the difference, the higher the degree of deviation from the normal pattern.

[0121] Third anomaly detection result: The anomaly detection result generated by the Anomaly Transformer model layer, based on the analysis of time series data and the identification of abnormal patterns.

[0122] Extract key indicators with time dimension from audit data:

[0123] Network traffic data: such as inbound / outbound traffic, connection count, packet size, etc.

[0124] System resource usage data: such as CPU usage, memory occupancy, disk I / O, etc.

[0125] Operational behavior time series information: such as login attempt time, file access time, command execution time, etc.

[0126] These data are organized into sequences of fixed time windows for subsequent time series analysis.

[0127] Through the self-attention mechanism, the model calculates the correlation strength between any two time points in the sequence, which can be represented by query (Q), key (K), and value (V). That is, the input sequence is converted into three different vector representations, the similarity between Q and K is calculated through dot product operation to get attention weight, and V is weighted aggregated according to attention weight to generate features containing long-term dependencies, allowing the model to capture implicit relationships between distant time points, such as identifying long-interval attack preparation and execution phases.

[0128] The encoder converts time series data and long-term dependency features into more abstract feature representations, applies multiple self-attention heads in parallel to capture different angles of dependency, performs nonlinear transformations on the attention output to enhance feature expression capabilities, maintains gradient flow to improve training stability, and through this process, the model learns the complex patterns and features of time series data, forming a feature vector for each time step.

[0129] The decoder predicts future system behavior based on the feature representations generated by the encoder, ensuring that the prediction only relies on current and previous time step information, correlates the feature representations of the encoder, uses historical information for prediction, and converts the decoding results into actual prediction values such as network traffic or resource usage prediction values. This process simulates the normal behavior patterns of the system and generates an expected behavior sequence.

[0130] Compare the predicted behavior sequence with the actual observed behavior sequence, calculate the difference, which can be calculated as the deviation between the predicted value and the actual value at each time point, and consider the overall difference of the sequence, set an abnormality judgment threshold based on the statistical characteristics of historical data, the higher the difference score, the more the current behavior deviates from the normal pattern, indicating the presence of an anomaly.

[0131] Based on the difference information and predefined abnormal patterns, automatically classify and output the anomaly detection results, determine the specific time point and related indicators of the anomaly occurrence, classify into malicious programs, host anomalies, and other types based on abnormal characteristics and behavior patterns, evaluate the severity of the anomaly based on the difference size and impact range, and include anomaly details, impact range, and warning information.

[0132] By capturing complex temporal dependencies, Anomaly Transformer can identify hidden anomalies that traditional methods cannot detect, such as slow performance attacks or gradual data leaks. As an unsupervised learning method, the model can be trained without a large number of labeled anomaly samples, reducing data collection and labeling costs. The model design supports online learning and real-time analysis, enabling immediate alerts when security incidents occur, and automatically adapting to normal changes in system behavior to reduce false positives caused by system upgrades or business changes.

[0133] Through attention weight visualization, the model's focus on key time points and features can be explained to assist security analysis; it can identify multiple types of abnormal behavior, including known and unknown attack patterns, providing comprehensive security protection; and time series analysis results can be combined with rule-based detection and semantic analysis to form a multi-level security protection system, improving overall detection accuracy.

[0134] Specifically, the following key fields are extracted from the logs corresponding to the audit data, which will help identify and match abnormal behavior and their corresponding strategies:

[0135] event_type: identifies the type of event, such as host_anomaly;

[0136] timestamp: timestamp recording the specific time when the anomaly event occurred;

[0137] host_id: unique identifier of the target host;

[0138] source_ip: source IP address;

[0139] destination_ip: destination IP address;

[0140] user_id: user identifier;

[0141] action_type: type of action performed (such as remote_command);

[0142] action_result: result of the action performed (such as success);

[0143] command: command executed (such as rm-rf / tmp);

[0144] resource_usage: contains resource usage such as CPU, memory, disk IO, etc.

[0145] network_traffic: contains network traffic information such as bytes sent and received, protocol type, port number, etc.

[0146] anomaly_score: anomaly score indicating the severity of the anomaly;

[0147] anomaly_type: anomaly type (such as remote_command_execution);

[0148] triggered_rule: triggered rule name (such as unusual_command_execution);

[0149] threat_level: threat level (such as critical);

[0150] recommended_action: recommended countermeasures (such as block_ip_and_alert_admin);

[0151] additional_context: Additional context information such as whether it is a VPN, Tor, geolocation, user agent, etc.

[0152] The Anomaly Transformer model uses self-attention mechanisms to model time series data and user behavior logs to identify complex anomalous behavior. Based on the results of the model analysis, the following rules are combined to select the appropriate strategy:

[0153] The anomaly_type is remote_command_execution, which means that the system detected suspicious command execution behavior. The command: rm -rf / tmp is a dangerous command that could lead to data loss or system compromise. The action_type is remote_command, indicating that there was remote command execution behavior. The triggered_rule is unusual_command_execution, meaning that the command may be abnormal. Based on this information, it can be inferred that the current event is abnormal due to the execution of an unusual or dangerous command, and appropriate measures should be taken based on the risk level.

[0154] In resource_usage, CPU usage is 95%, memory usage is 80%, and disk IO is high, indicating that the system load is high, which may be due to malicious behavior or resource abuse. In this case, resource limits can be increased or alerts can be triggered to address potential resource abuse or DoS attacks.

[0155] In network_traffic, the data sent is 102400 bytes, the data received is 51200 bytes, the protocol is TCP, and the port is 22. Port 22 indicates an SSH connection, which is usually used for remote login. If this network traffic pattern is inconsistent with the normal pattern, such as coming from an unusual source IP or sending a large amount of data, it may indicate abnormal remote access behavior.

[0156] The Anomaly Transformer layer is used in the following scenarios:

[0157] Host Anomaly Detection: Anomaly Transformer can model the operational behavior of hosts by analyzing log data to identify potential malicious behavior or system configuration tampering; Remote Command Execution Detection: the system can identify abnormal remote command execution behavior, timely alarm and take response measures; Denial of Service (DoS) Attack Detection: by calculating the error between predicted traffic and actual traffic, if the error exceeds the set threshold, the system considers that there is a potential DoS attack behavior in this period.

[0158] Network traffic data is collected from the data platform or network monitoring system, mainly including the source IP, target IP, request time, request frequency, request type, traffic peak, request interval, etc. After extracting the data features, the noise data is removed, and the normalized processing is performed, and the features related to the traffic pattern are extracted, which adapt to the input requirements of the AnomalyTransformer model, and form the traffic data matrix in the time window.

[0159] During the training process, the AnomalyTransformer model is trained using historical normal traffic data and known DoS attack data. The model learns the feature representation of normal traffic patterns and learns the rules of traffic fluctuations through self-attention mechanism. The training goal is to minimize the error between actual traffic and model predicted traffic, and optimize the parameters of the model, so that it can efficiently and accurately detect DoS attacks in real-time monitoring.

[0160] In actual deployment, the Anomaly Transformer model analyzes the traffic data entering the data platform or network system in real time. By calculating the prediction error of the traffic data in each time window, it determines whether there is a DoS attack. If the error exceeds the set threshold, the system will immediately trigger the alarm mechanism and issue a DoS attack alert, and further start the response mechanism, such as traffic speed limit, IP ban, etc.

[0161] Error calculation formula for anomaly detection:

[0162] Where X t is the actual traffic data at time t, is the model predicted traffic data, and ||.||2 represents the L2 norm (Euclidean distance). If the error exceeds the set threshold, the model considers that there is an anomaly in the current period.

[0163] Anomaly detection threshold setting: a dynamic error threshold is set through statistical methods, assuming that the model's prediction error for normal traffic during training is μ normal (mean), and the standard deviation is σ normalk is an adjustment parameter, which can be adjusted according to the needs of the system, and is usually 2 to 3. In order to reduce false positives and false negatives, the system sets the threshold according to the distribution characteristics of historical data: Threshold = μ normal + K. σ normal .

[0164] In a possible embodiment, after step 130, the following steps can also be included:

[0165] The method further includes:

[0166] According to the anomaly detection result, an anomaly detection report is generated, which includes statistical information of abnormal behavior data, trend analysis information and comprehensive evaluation information of system security status.

[0167] Anomaly detection report: a comprehensive security report generated based on the anomaly detection result, used to systematically present security events, behavior patterns and risk assessment, and provide data support for security decision-making.

[0168] Statistical information: quantitative summary of abnormal behavior data, including quantifiable indicators such as abnormal type distribution, occurrence frequency, impact range, reflecting the scale and characteristics of security problems.

[0169] Trend analysis information: analysis of the change law of abnormal data based on time dimension, identifying the development trend, periodic characteristics or burst mode of abnormal behavior, and assisting in predicting potential risks.

[0170] Comprehensive evaluation information: qualitative evaluation of the overall security status of the system by combining the anomaly detection result and the business scenario, including risk level, weak link and security improvement suggestions.

[0171] Collect at least one of the first anomaly detection result, the second anomaly detection result and the third anomaly detection result from the policy configuration layer, the large model layer and the Anomaly Transformer model layer, extract key information such as abnormal type, occurrence time and impact object, and form a standardized abnormal event data set.

[0172] Count by abnormal type, time window and impact dimension to form an abnormal distribution histogram or pie chart, calculate indexes such as average response time of abnormal events and impact range coverage rate, and quantify the severity of security threats. Arrange the abnormal data in time sequence, identify trends, periodicity or burst points through sliding window or regression analysis. Combine business cycles or external threat intelligence to explain the causes of abnormal trends.

[0173] Based on the severity, frequency, and potential loss of anomalies, the system's security status is quantitatively scored, such as 1-10 points. By identifying the system's security shortfalls through high-frequency occurrence points or co-occurrence characteristics of abnormal data, targeted measures are generated based on the evaluation results.

[0174] Through statistical and trend analysis, scattered abnormal events are transformed into an intuitive security situation view, helping managers quickly grasp the overall risk. Comprehensive evaluation information provides data-driven decision-making basis for security resource allocation and strategy adjustment. Trend analysis can identify the evolution direction of security threats in advance, such as "a certain type of new attack frequency doubles in two weeks", prompting the team to deploy protective measures in advance.

[0175] In one possible embodiment, after step 130, the following steps can also be included:

[0176] According to the anomaly detection result, determine the response measure; the anomaly detection result includes: anomaly type and early warning information;

[0177] When the anomaly type is brute force cracking, the response measure includes: blocking the corresponding IP address, limiting the login of the IP address corresponding to the brute force cracking within a preset time period;

[0178] When the anomaly type is data leakage, the response measure includes: suspending the related data access permission, notifying the data administrator for verification, and encrypting or isolating the related data;

[0179] When the anomaly type is SQL injection attack, the response measure includes: blocking the corresponding user request, re-verifying the user identity data corresponding to the user request, and auditing the database operation;

[0180] When the anomaly type is denial of service attack, the response measure includes: starting the flow limiting strategy, limiting or banning the attack source IP, and adjusting the system resource allocation strategy.

[0181] Response measure: automatically triggered handling strategy for detected security anomalies, aiming to quickly contain threat spread, reduce loss, and provide support for subsequent investigation.

[0182] Brute force cracking: an attack method in which attackers attempt to obtain system access by trying a large number of password combinations. Common features include high-frequency login failure requests from the same IP to the same account or multiple accounts within a short period of time.

[0183] Data leakage: a security event in which unauthorized sensitive data is accessed, transmitted, or exposed. It may manifest as abnormal data access patterns, unauthorized operations, or suspicious data transmission traffic.

[0184] SQL Injection Attack: Attackers bypass application input validation mechanisms by constructing malicious SQL statements, directly manipulating the database. Typical characteristics include SQL keywords or abnormal SQL syntax structures in requests.

[0185] Denial of Service Attack: Attackers exhaust system resources or service connections, preventing legitimate users from accessing services normally. Common manifestations include abnormal traffic surges or connection request storms.

[0186] Traffic Limitation Strategy: Network devices control the access frequency and bandwidth of specific IPs or services to mitigate the impact of DoS attacks.

[0187] Based on the preset security policy library, the system automatically maps the detected anomaly types to corresponding response measures. According to the type label in the anomaly detection result, the system searches for predefined handling rules in the policy library. Based on the severity and confidence of the anomaly, the system executes different levels of response:

[0188] Automatic Blocking: Immediately execute blocking operations for high-risk anomalies without human intervention.

[0189] Manual Review: Trigger an alarm for medium-risk anomalies and suspend related operations, waiting for the security team to confirm before executing subsequent measures.

[0190] Monitoring and Observation: Continuously monitor low-risk anomalies without immediate blocking.

[0191] Taking brute force cracking as an example, the response process can include:

[0192] Audit data shows that a certain IP has failed to log in more than 15 times within 10 minutes; the system automatically matches the "brute force cracking" response rule and generates IP blocking instructions; executes IP blocking through security device API; sets the blocking time to 30 minutes, and automatically removes the restriction after expiration.

[0193] Through the automated response mechanism, the average processing time of security incidents is reduced from hours to seconds, significantly reducing the attack window. For example, IP blocking can be completed within 30 seconds after a brute force cracking attack, preventing the attacker from continuing to attempt.

[0194] Through layered response strategies, the impact of high-risk anomalies is controlled to the minimum, avoiding the evolution of single-point attacks into systematic destruction. For example, after a SQL injection attack is blocked, the database integrity is guaranteed and business continuity is not affected.

[0195] Traffic limiting strategies can maintain the availability of core services during DDoS attacks, ensuring that critical business is not affected by non-critical traffic. For example, by dynamically adjusting bandwidth allocation, ensuring that payment systems can still function normally during attacks.

[0196] In the embodiments of the present application, by obtaining audit data, the audit data includes at least one of the following: user identity data, operation time, operation type, operation object, operation result, IP address, operation behavior information, command line input data, network request information and system resource usage data; determine the detection model according to the audit data, the detection model is associated with the data type of the abnormal behavior data in the audit data, the detection model includes at least one of the following: policy configuration layer, large model layer based on natural language processing and Anomaly Transformer model layer; the rule-based detection mechanism can immediately identify security threats that conform to known patterns, providing timely warnings for security teams; the semantic understanding ability of the natural language processing large model enables the system to adapt to new attack methods without frequent updates to the rule library; the time series analysis capability of Anomaly Transformer enables the system to detect anomalies in data streams in real time and respond to potential threats in a timely manner; input the audit data into the detection model, which can detect the audit data through at least one of the policy configuration layer, the large model layer based on natural language processing and the Anomaly Transformer model layer, identify behaviors or events that do not conform to normal patterns, and obtain abnormal detection results, which can improve the accuracy of abnormal detection of audit data and support more effective security decisions.

[0197] The following will be described in conjunction with several specific embodiments:

[0198] Embodiment 1: Data leakage detection scenario:

[0199] The data center processes a large amount of sensitive data every day, involving personal accounts, operation records, etc. To prevent data leakage, the system sets data access permissions and access frequency rules at the policy configuration layer. Implementation process:

[0200] Define each user's access permissions to sensitive data and limit access frequency. For example, limit each user's access to sensitive data to no more than 50 times a day, and only allow access during working hours (9:00 AM-6:00 PM).

[0201] The monitoring process can include:

[0202] (1) The system monitors the access behavior of all users in real time, recording the access records of each user (including access IP address, data type, access time, etc.).

[0203] (2) Set rules: For example, if a user accesses a large amount of sensitive data during non-working hours or performs unusually frequent access within a short period of time, the system will automatically trigger an alarm.

[0204] (3) Alarm mechanism: When a user's behavior exceeds the preset rules, the system notifies the security team through email, SMS, etc. and initiates further investigation.

[0205] Example 2: Brute force attack detection scenario:

[0206] The policy configuration layer sets the threshold for the number of failed login attempts and performs real-time monitoring. When the number of failed login attempts for an account exceeds 5 within 10 minutes, the system triggers an alarm. The large model further analyzes the login behavior and determines that the abnormal login attempts from an abnormal IP do not match the user's normal behavior, ultimately confirming the existence of a brute force attack.

[0207] Example 3: Web attack identification scenario:

[0208] A company's web application faces threats such as SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), and other web attacks. To protect the website from malicious attacks, the system performs semantic analysis of web requests through a large model to identify potential web attack behaviors.

[0209] The implementation process can include:

[0210] The large model can identify potential web attacks such as SQL injection, XSS, CSRF, etc. by performing in-depth natural language processing and semantic analysis on user-submitted HTTP requests, API interface request headers, request bodies, URLs, and POST data. The large model is trained based on a large amount of historical attack data, learning the differences between normal business processes and malicious attacks.

[0211] The large model analyzes the semantic structure and data content of HTTP requests and API interfaces to identify request patterns that deviate from normal business operations. For each type of web attack, the model matches the abnormal patterns in the request to determine whether it is a potential attack.

[0212] The model can identify requests containing illegal SQL statements, especially SQL code submitted through input boxes, such as "'OR 1=1--". The model checks whether the input data format conforms to normal business logic, and if an anomaly is found, it immediately marks it as a SQL injection attack.

[0213] The model analyzes user-entered script code (e.g., JavaScript) to detect whether it contains malicious scripts such as <script>alert(1)< / script>The model analyzes the code structure in the request data to identify potential XSS attacks.

[0214] The model can detect if there is a request for forgery, such as a malicious request disguised as a valid user request. The large model analyzes the source of the request, the Referer header information, and the Token verification mechanism to determine if it is consistent with normal user request behavior.

[0215] When the large model identifies potential web attacks, the system will immediately trigger an alarm to notify the administrator for processing. The system will provide detailed attack information, including attack type, IP address of malicious request, timestamp, request parameters, etc., to help the administrator quickly locate the source of the problem. According to the rules, the system can further prevent the execution of malicious requests, take measures such as traffic restriction, IP blocking, and verification code verification to prevent attacks from further affecting the system.

[0216] Example 4: Denial of Service (DoS) attack detection scenario:

[0217] Web services are subject to denial of service (DoS) attacks, attackers occupy server resources through a large number of requests, causing service interruption. In order to identify and respond to DoS attacks in a timely manner, the system uses the Anomaly Transformer model to analyze network traffic data obtained from the data center, accurately detects abnormal traffic and issues an alarm.

[0218] The data center integrates data sources from multiple systems, including business data, user request logs, application monitoring data, and traffic data. Through a unified data pipeline, the traffic monitoring system transmits network request data to the data center in real time.

[0219] Key features are extracted from traffic data, such as source IP, target IP, request timestamp, request type, request frequency, etc. The system uses the data cleaning module of the data center to denoise the original traffic data, remove irrelevant data and standardize it, ensuring that all traffic data is compared on the same scale.

[0220] Normalize the time series features such as request frequency, request interval, and traffic fluctuation amplitude, and generate sliding window time series data to provide input for the Anomaly Transformer model. Normalized data helps eliminate biases in different time periods and different network states, improving the accuracy of anomaly detection.

[0221] Anomaly Transformer is based on self-attention mechanism, which can handle large amounts of time series data and analyze the dependencies between different time steps. When detecting DoS attacks, the model analyzes the time series changes of traffic data and identifies whether there are abnormal fluctuations that do not conform to the normal traffic pattern.

[0222] When modeling time series traffic data, the model can learn the long-term dependencies between requests. For example, within a time window, Anomaly Transformer analyzes the step-by-step increase in request volume through self-attention mechanism, and can detect abnormal traffic surges. Compared with traditional statistical or rule-based methods, Anomaly Transformer can capture more complex traffic pattern changes and detect from a global perspective.

[0223] The encoder part of the model encodes the traffic data through multiple layers of self-attention and feedforward neural networks, extracting the feature representation of normal traffic. The decoder generates predictions for future traffic based on the encoded information. The system detects abnormal traffic in real time by comparing the predicted value with the actual traffic.

[0224] By calculating the error between the model's predicted traffic and the actual traffic, such as the L2 norm, the system can identify abnormal fluctuations in traffic patterns. The error threshold is dynamically adjusted by the system based on the distribution characteristics of historical traffic.

[0225] After the deployment of the Anomaly Transformer model, the system monitors all network traffic data collected through the data platform in real time and predicts and analyzes the traffic within each time window. When the model detects abnormal fluctuations in traffic, it immediately triggers an alarm.

[0226] Once the error exceeds the set threshold, the system will immediately generate a DoS attack alert to notify the system administrator. The alert information includes details such as the time of abnormal traffic, peak traffic, attack source IP, request path, etc. The administrator can track the attack source based on this information and take appropriate security measures.

[0227] To improve response efficiency, the system can set up automated protection measures such as traffic limitation, IP blocking, or request redirection. By integrating with the enterprise's security protection system, the system can automatically intercept malicious traffic and reduce the impact of DoS attacks on servers.

[0228] The anomaly detection method for audit data provided by the embodiments of the present application can be executed by the anomaly detection device for audit data. In the embodiments of the present application, the anomaly detection method for audit data executed by the anomaly detection device for audit data is taken as an example to illustrate the anomaly detection device for audit data provided by the embodiments of the present application.

[0229] Figure 4 is a block diagram of an abnormality detection device for audit data provided by an embodiment of the present application. The device 400 comprises:

[0230] The acquisition module 410 is configured to acquire audit data, wherein the audit data comprises at least one of the following: user identity data, operation time, operation type, operation object, operation result, IP address, operation behavior information, command line input data, network request information, and system resource usage data.

[0231] The determination module 420 is configured to determine a detection model according to the audit data, wherein the detection model is associated with a data type of abnormal behavior data in the audit data, and the detection model comprises at least one of the following: a policy configuration layer, a large model layer based on natural language processing, and an Anomaly Transformer model layer.

[0232] The input module 430 is configured to input the audit data into the detection model to obtain an abnormality detection result.

[0233] In the embodiments of the present application, the audit data is acquired, wherein the audit data comprises at least one of the following: user identity data, operation time, operation type, operation object, operation result, IP address, operation behavior information, command line input data, network request information, and system resource usage data. A detection model is determined according to the audit data, wherein the detection model is associated with a data type of abnormal behavior data in the audit data, and the detection model comprises at least one of the following: a policy configuration layer, a large model layer based on natural language processing, and an Anomaly Transformer model layer. A rule-based detection mechanism can immediately identify security threats that conform to known patterns, providing timely warnings for security teams. The semantic understanding ability of the natural language processing large model enables the system to adapt to new attack methods without frequent updates to the rule library. The time series analysis ability of the Anomaly Transformer enables the system to detect abnormalities in data streams in real time and respond to potential threats in a timely manner. The audit data is input into the detection model, which can detect the audit data through at least one of the policy configuration layer, the large model layer based on natural language processing, and the Anomaly Transformer model layer, identify behaviors or events that do not conform to normal patterns, and obtain an abnormality detection result, thereby improving the accuracy of abnormality detection of the audit data and supporting more effective security decisions.

[0234] The abnormality detection device for audit data provided by the embodiments of the present application can implement each process implemented by the method embodiments. To avoid repetition, details are not described here.

[0235] Figure 5A hardware structure schematic diagram of an electronic device is shown.

[0236] The electronic device can include a processor 501 and a memory 502 storing computer program instructions.

[0237] Specifically, the processor 501 can include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement one or more embodiments of the present application.

[0238] The memory 502 can include a mass storage for data or instructions. By way of example and not limitation, the memory 502 can include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. The memory 502 can include removable or non-removable (or fixed) media, where appropriate. The memory 502 can be internal or external to the integrated gateway disaster recovery device, where appropriate. In particular embodiments, the memory 502 is non-volatile, solid-state memory. In particular embodiments, the memory 502 includes read-only memory (ROM). Where appropriate, this ROM can be mask-programmed ROM, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), electrically alterable ROM (EAROM), or flash memory or a combination of two or more of these. In some embodiments, the memory 502 includes ROM.

[0239] The processor 501 reads and executes the computer program instructions stored in the memory 502 to implement any one of the anomaly detection methods for audit data in the embodiments shown in the figures.

[0240] In one example, the electronic device can further include a communication interface 505 and a bus 510. As shown, the processor 501, the memory 502, and the communication interface 505 are connected through the bus 510 and complete communication among each other. Figure 5

[0241] The communication interface 505 is mainly used to realize the communication among the modules, devices, units and / or equipment in the embodiments of the present application.

[0242] ​Bus 510 includes hardware, software, or both, to couple electronic devices to each other in a manner that allows information to be passed between or among them. The bus can include, for example, an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand (IB) interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association local (VLB) bus, or another suitable bus or a combination of two or more of these. Where appropriate, bus 510 can include one or more buses. Although the application embodiments described and illustrated herein focus on particular buses, the application contemplates any suitable bus or interconnect.

[0243] The electronic device can perform the method for detecting anomaly of audit data in the embodiments of the application, thereby realizing the method for detecting anomaly of audit data described in the embodiments of the application. Figure 2 The method for detecting anomaly of audit data described.

[0244] In addition, in combination with the method for detecting anomaly of audit data in the above embodiments, the embodiments of the application can provide a computer readable storage medium to realize. The computer readable storage medium has computer program instructions stored thereon; the computer program instructions are executed by a processor to realize the method for detecting anomaly of audit data. Figure 1 The method for detecting anomaly of audit data.

[0245] It needs to be clear that the application is not limited to the specific configurations and processes described above and shown in the drawings. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between steps, after understanding the spirit of the application.

[0246] The functional blocks shown in the structural block diagrams described above can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application specific integrated circuits (ASICs), appropriate firmware, plug-ins, functional cards, and the like. When implemented in software, the elements of the present application are program or code segments that are used to perform the required tasks. The program or code segments can be stored in a machine-readable medium or transmitted through a data signal carried in a carrier wave over a transmission medium or communication link. A "machine-readable medium" includes any medium that can store or transport information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, and the like. The code segments can be downloaded via computer networks such as the Internet, intranets, and the like.

[0247] It should also be noted that the exemplary embodiments mentioned in the present application describe some methods or systems based on a series of steps or devices. However, the present application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiments, or in an order different from that in the embodiments, or several steps can be performed simultaneously.

[0248] The above description is merely a specific implementation of the present application. Those skilled in the art can clearly understand the specific working processes of the above-described systems, modules and units based on the foregoing method embodiments, and thus will not be described here. It should be understood that the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be covered within the protection scope of the present application.

Claims

1. A method for detecting anomalies in audit data, characterized in that, The method includes: Obtain audit data, which includes at least one of the following: user identity data, operation time, operation type, operation object, operation result, IP address, operation behavior information, command line input data, network request information, and system resource usage data; A detection model is determined based on the audit data, and the detection model is associated with the data type of abnormal behavior data in the audit data. The detection model includes at least one of the following: a strategy configuration layer, a large model layer based on natural language processing, and an anomaly attention (Anomaly Transformer) model layer. The audit data is input into the detection model to obtain anomaly detection results.

2. The method according to claim 1, characterized in that, The step of inputting the audit data into the detection model to obtain anomaly detection results includes: When the detection model includes the strategy configuration layer, the audit data is detected by preset detection rules, and a first anomaly detection result is output. When the detection model includes the large model layer, natural language processing technology is used to perform contextual analysis on the text information in the audit data, and a second anomaly detection result is output. When the detection model includes the Anomaly Transformer model layer, features are extracted from the time-series data in the audit data based on the self-attention mechanism, and a third anomaly detection result is output.

3. The method according to claim 2, characterized in that, When the detection model includes the strategy configuration layer, the audit data is detected by preset detection rules, and a first anomaly detection result is output, including: Set preset detection rules for different operational behavior indicators, and the preset detection rules include at least one of the following: login failure number threshold, data access permission rules, and access frequency rules; Based on the audit data, operational behavior indicators are statistically analyzed, and the operational behavior indicators include at least one of the following: number of failed user logins, number of data accesses, and access time interval; The audit data corresponding to the operation behavior indicators is detected by the preset detection rules, and a first anomaly detection result is output. The first anomaly detection result includes a first anomaly type and a first warning information. The first anomaly type includes at least one of the following: brute-force attack, account anomaly, data leakage; the warning information includes at least one of the following: anomaly occurrence time, user identity data, IP address, and target of operation.

4. The method according to claim 2, characterized in that, When the detection model includes the large model layer, natural language processing technology is used to perform contextual analysis on the text information in the audit data, and a second anomaly detection result is output, including: Extract the request body and command line fields from the audit data; The request body and command line fields are subjected to pattern matching to obtain the attack pattern, which includes at least one of the following: SQL injection pattern, privilege abuse pattern, and vulnerability exploitation pattern. Contextual analysis is performed on the audit data to obtain text analysis results; the text analysis results include at least one of the following: user information, geographical location, and device information; Based on the attack pattern and the text analysis results, a second anomaly detection result is output.

5. The method according to claim 2, characterized in that, The Anomaly Transformer model includes a self-attention layer, an encoder, and a decoder. When the detection model includes the Anomaly Transformer model layer, feature extraction is performed on the time-series data in the audit data based on the self-attention mechanism, and a third anomaly detection result is output, including: The time-series data is extracted from the audit data, and the time-series data includes at least one of the following: network traffic data, system resource usage data, and timing information of operational behaviors. Through the self-attention layer, the dependency relationship between time series data corresponding to different time steps is calculated based on the self-attention mechanism to obtain long-term dependency features; The encoder encodes the time series data and the long-term dependency features to generate a feature representation for each time step. The decoder decodes the feature representation of each time step to obtain the predicted traffic behavior sequence. By comparing the predicted traffic behavior sequence with the actual traffic behavior sequence, the difference information is obtained; The third anomaly detection result is output based on the difference information. The abnormal behavior type in the third anomaly detection result includes at least one of the following: malicious program, host anomaly, remote command execution, and denial-of-service attack.

6. The method according to claim 1, characterized in that, After inputting the audit data into the detection model to obtain the anomaly detection result, the method further includes: Based on the anomaly detection results, an anomaly detection report is generated, which includes statistical information on abnormal behavior data, trend analysis information, and comprehensive evaluation information on system security status.

7. The method according to claim 1, characterized in that, After inputting the audit data into the detection model to obtain the anomaly detection result, the method further includes: Based on the anomaly detection results, response measures are determined; the anomaly detection results include: anomaly type and early warning information; When the anomaly type is brute-force attack, the response measures include: blocking the corresponding IP address and restricting the login of the IP address corresponding to the brute-force attack within a preset time period; When the anomaly type is data leakage, the response measures include: suspending access to the relevant data, notifying the data administrator to conduct verification, and encrypting or isolating the relevant data. When the anomaly type is an SQL injection attack, the response measures include: blocking the corresponding user request, re-verifying the user identity data corresponding to the user request, and auditing the database operations; When the anomaly type is a denial-of-service attack, the response measures include: activating a traffic limiting policy to limit or block the attack source IP, and adjusting the system resource allocation policy.

8. An anomaly detection device for audit data, characterized in that, The device includes: The acquisition module is used to acquire audit data, which includes at least one of the following: user identity data, operation time, operation type, operation object, operation result, IP address, operation behavior information, command line input data, network request information, and system resource usage data; A determination module is used to determine a detection model based on the audit data. The detection model is associated with the data type of abnormal behavior data in the audit data. The detection model includes at least one of the following: a strategy configuration layer, a large model layer based on natural language processing, and an Anomaly Transformer model layer. The input module is used to input the audit data into the detection model to obtain the anomaly detection results.

9. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the anomaly detection method for audit data as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the anomaly detection method for audit data as described in any one of claims 1-7.

Images